Analysis
-
max time kernel
89s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-05-2024 09:11
Static task
static1
Behavioral task
behavioral1
Sample
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe
Resource
win10v2004-20240508-en
General
-
Target
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe
-
Size
267KB
-
MD5
b4083eecf5e10cf9fca51af2207fe512
-
SHA1
6344052f3e59e83da44adc2546dd0a102655d9fe
-
SHA256
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03
-
SHA512
8fff262307891b31460044dec1c44d5a8fd62846a70063ec01c1a5ec5bd654bcc1a8b7c66644cc87e929ed0def377d0bcf736d7d50d985b629c8077343317202
-
SSDEEP
3072:D+XdB/Z0gKFFILw6To75ScUga3BQ0H53nrCr5bxBxiiQJCm5Rq2tl4l/:uHX3wR5mx53nrCvi0boW
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3344 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 3208 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 2920 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 3228 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 4932 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 4832 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 768 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 4124 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe 888 1868 WerFault.exe de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 884 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 884 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.execmd.exedescription pid process target process PID 1868 wrote to memory of 2756 1868 de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe cmd.exe PID 1868 wrote to memory of 2756 1868 de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe cmd.exe PID 1868 wrote to memory of 2756 1868 de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe cmd.exe PID 2756 wrote to memory of 884 2756 cmd.exe taskkill.exe PID 2756 wrote to memory of 884 2756 cmd.exe taskkill.exe PID 2756 wrote to memory of 884 2756 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe"C:\Users\Admin\AppData\Local\Temp\de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 4762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 7962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 8922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 10002⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 10882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 14642⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "de801c8a6902f57ca4e5f701ab649921a5df663388444751a4c6bcf458dd0c03.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 4882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1868 -ip 18681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1868-1-0x0000000002430000-0x0000000002530000-memory.dmpFilesize
1024KB
-
memory/1868-2-0x0000000004060000-0x000000000409C000-memory.dmpFilesize
240KB
-
memory/1868-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1868-8-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1868-7-0x0000000004060000-0x000000000409C000-memory.dmpFilesize
240KB
-
memory/1868-6-0x0000000000400000-0x000000000235F000-memory.dmpFilesize
31.4MB